Forensic ZTE Data Recovery - Bypassing Mobile Phone Lock & Full Physical Extraction: Recover deleted data, messages, photos and much more from a locked ZTE phone.
- Viktor Dante
- May 11
- 9 min read
Updated: 5 days ago
DIFFICULTY: Moderate to High
Introduction - Advanced Forensic Extraction from the ZTE Optus X Vista (Z66210):
Forensic ZTE Data Recovery: The ZTE Optus X Vista is powered by the Unisoc SC9863A system-on-chip (SoC) — a low-cost, quad-core processor designed for entry-level Android devices. Despite its modest performance, the SC9863A chipset includes security layers that prevent access to the user partition once the phone is locked. The combination of:
No ADB access (USB debugging off)
No root or bootloader unlock
Encrypted NAND storage
Lack of firmware flashing tools from the manufacturer
PIN/pass has been lost or forgotten by user
...means that standard data recovery software is completely ineffective in these scenarios. To make matters worse, bootloader unlocking typically triggers a factory reset, permanently destroying the very data clients are trying to preserve.
ZTE Optus X Vista is powered by the Unisoc SC9863A system-on-chip (SoC)
Main display: IPS TFT 16M colors 720 x 1520 px (6.26″) 269 ppi
Processor: Unisoc SC9863A 1.60 GHz [Number of cores: 8]
Internal memory: 16 GB
RAM: 2 GB
Battery: Li-Ion 3200 mAh
Camera: 13 Mpx
Regarding mobile forensic recovery, few devices present as many challenges as low-end ZTE smartphones, especially those based on Spreadtrum/Unisoc chipsets. One of Australia's most commonly encountered models is the ZTE Optus X Vista (model Z66210). While budget-friendly and widely distributed through carriers like Optus, this device becomes a digital fortress the moment a screen lock is forgotten and USB debugging is disabled.
At Wildfire Data Recovery, we regularly deal with cases involving ZTE devices like the Z66210 where the phone is locked, access is critical, and factory reset is not an option due to the importance of the data inside — from legal documents, to deleted text messages and photos and chat logs, to proprietary invention files and evidence related to estates.
Using MOBILEdit Forensic Ultra: How does this software allow us to gain full physical access to a locked mobile phone?
To overcome these challenges, we use MOBILedit Forensic Ultra, a professional-grade forensic suite capable of initiating a secure low-level bypass using the SC9863A chipset's hidden hardware interfaces. This tool allows us to:
Trigger a non-destructive preload boot mode using chipset-specific key combos (VOL DOWN + USB insert);
Establish a secure connection even without USB debugging or a working screen PIN;
Extract a full bit-by-bit physical image of the NAND (internal storage)
Perform a brute-force attack to determine the PIN and decrypt the data;
Fully parse, search, and export messages, documents, photos, app data, and more.
This guide will walk you through how such forensic recovery is performed — step by step — using the real-world example of the ZTE Optus X Vista.
It is intended for forensic investigators, legal professionals, and advanced data recovery technicians who need a deeper understanding of how to handle locked, Spreadtrum-based Android devices without risking a reset or data loss.
NOTICE: While this guide focuses specifically on the ZTE Optus X Vista, the same recovery process applies to many other low-end Android smartphones powered by Spreadtrum/Unisoc chipsets:
including devices from Alcatel,
Itel,
Lava, and
Telstra-branded ZTE models like the A2 and Smart series.
These devices often share:
The same SC9832E or SC9863A chipset family
Locked bootloaders with no unlock options
No custom recovery or root community
The same diagnostic handshake trigger (e.g., VOL DOWN + USB)
These phones share the same underlying chipset architecture and security limitations, making this method broadly useful for a wide range of forensic scenarios.
What is UNISOC and how to use UNISOC Offline Decrypt (https://www.oxygenforensics.com/en/resources/unisoc-support/)
UNISOC is a Chinese company that was previously known as Spreadtrum. Founded in 2001, it originally produced chips for entry-level cell phones. This policy proved to be successful: in 2008 the majority of China Mobile subscribers were using phones built on Spreadtrum processors. This turned Spreadtrum into a telecommunications giant.
Supported Chipsets:
SC9820E | Energizer E280s, Energy E220s, Energy E241s and more |
SC9832E | myPhone Fun 9 and more |
SC9863A | Doogee Y7 Alcatel 1S/1SE2020/1V 2019 Blackview A52 and more |
The above apply to ZTE mobile devices (amongst others) allowing for UNISOC decrypt to be implemented.
Potential Hurdles:
User data encryption:
User data encryption is enabled in all modern Android devices by default and cannot be disabled. Starting with Android 10, the file-based encryption (FBE) is used on the devices, implemented with the aid of hardware keys.
The memory of all modern UNISOC-based devices is encrypted. The hardware key, knowledge of the screen lock password, and the encryption mechanism are required for successful data decryption.
One part of the encryption algorithm is the same for all Android devices, while the other part is implemented in the Trusted Execution Environment (TEE) and depends on the TEE OS. The vast majority of UNISOC devices use Trusty TEE. This uniformity allows for the implementation support of the extensive list of devices from different vendors.
If the device is using file-based encryption, there are two data storage options:
Device Encrypted (DE)
Credential Encrypted (CE)
What Unisoc chipsets and Android versions are supported?
Mobile devices from manufacturers such as Alcatel, Blackview, HTC, Lenovo, Motorola, Nokia, Wiko, ZTE, Samsung, Oppo, and more.
Unisoc (Spreadtrum) | Android OS |
SC9863A | 9.x-13.x version* |
T606 | |
T610 | |
T612 | |
T616 | |
T618 | |
T700 |
*up to 14.x version for File-Based devices
Data from DE storage is encrypted solely with the use of the hardware key and is accessible before password entry. Data from CE storage is encrypted using both the screen lock password and the hardware key. If the screen lock password is not set, data from both storage gets encrypted in the same way.
To decrypt all user data, an investigator must enter or brute force the screen lock password of the device under investigation. It is also possible to import the image without password entry. However, in this case, data from the CE storage won’t be available.
The speed depends on the PC from which the investigation is conducted. The GPU memory size is what affects the speed the most.
Since most users have a PIN of 4-6 digits or a pattern set as a lock screen password, the brute force process completes relatively fast. There are only about 1.5 million possible combinations, and it takes less than an hour to obtain the right passcode even when using a simple PC with an integrated GPU. On a PC with RTX 3080 Ti, the same process will take less than 3 minutes.
Solution
Extraction of hardware keys:
A vulnerability in the low-level proprietary protocol is exploited for the extraction of hardware keys. A special mode SPRD COM port serves as an entry point. In order to utilise it, connect a powered off device via USB by holding the volume up or down button, depending on the device.
How to put a Unisoc-based device into Boot ROM mode?
Some mobile devices, such as ZTE, Tecno, Infinix, Realme, and Motorola, can be put into the Boot ROM mode using the button combinations. Other devices, such as Nokia and Samsung, require short-circuiting of the test pins.
The vulnerability is contained in the BootROM and cannot be fixed with a software update. Once the vulnerability is exploited, it is possible to execute an arbitrary code with EL3 privileges on the device, which is enough to extract hardware keys from it. All actions are performed in RAM (Random Access Memory) and once the device is rebooted or the battery is re-inserted, the device returns to its original state. This means that the approach is non-destructive and safe for the data and the device.
🧰 Tools & Environment Setup
Before attempting a forensic extraction from a locked Spreadtrum/Unisoc-based device, it’s essential to prepare a controlled and secure forensic environment. This ensures that the data is handled correctly, no accidental overwrites occur, and the acquisition remains legally defensible.
Required Software:
MOBILedit Forensic Ultra (latest version)
Must include support for Spreadtrum/Unisoc chipsets
Offline security bypass module enabled
Required Hardware:
A stable forensic workstation (Windows-based, SSD recommended for fast image handling)
OEM-quality USB cable compatible with the ZTE device
Write-blocked external storage or an isolated forensic storage volume for saving the physical image
Uninterruptible Power Supply (UPS) to prevent interruption during image acquisition
Optional Tools:
Hashing utility (e.g., HashMyFiles, FTK Imager, or built-in MOBILedit hashing tools)
Virtual machine or sandbox for post-extraction analysis
Data parsing software (Oxygen Forensic Detective, Belkasoft X, or MOBILedit’s built-in tools)
Environment Setup Notes:
Ensure all auto-mounting and auto-play features are disabled on the forensic machine
Confirm that Windows Device Manager does not interfere or install firmware updates during the connection process
Isolate the workstation from the internet if dealing with sensitive legal or proprietary information
Secure Bypass & Physical Acquisition Procedure
Once your forensic environment is ready, the next phase involves placing the device into a special diagnostic communication mode — even when the phone is locked and USB debugging is disabled. This is achieved using a chipset-specific key combination to initiate a low-level preload handshake.
Step 1: Trigger Preload Mode (SC9863A Secure Handshake)
The Unisoc SC9863A chipset supports an undocumented preload mode that allows physical-level communication without booting into Android. To initiate:
Power off the ZTE Optus X Vista.
Press and hold the Volume Down button.
While holding Volume Down, connect the USB cable to the forensic workstation.
MOBILedit Forensic Ultra should automatically detect the device and begin the Secure Bypass Initialisation.
If successful, the device will not power on normally but instead enter a secure mode that exposes its NAND interface directly to the forensic tool.
Step 2: MOBILedit Device Initialisation & NAND Detection
Once connected, MOBILedit Forensic Ultra begins identifying the NAND structure. The software communicates directly with the device's storage controller, bypassing Android's operating system and lockscreen entirely.
Confirm the detection of a Spreadtrum/Unisoc device.
Confirm that the internal storage is visible (eMMC/NAND partitions).
Select bit-by-bit physical image acquisition.
Step 3: Start Physical Imaging
Begin the full physical imaging process. This will:
Create a sector-by-sector binary image of all partitions
Include active data, app data, unallocated space, and deleted files
During imaging:
Do not interrupt the connection.
Do not allow antivirus or system software to interfere.
Ensure MOBILedit remains in the foreground to prevent timeout.
Depending on the storage capacity and condition, the process may take 30–90 minutes.
You’ll be prompted to select a destination for the raw dump — ensure this is saved to a forensic-grade external or isolated disk.
Step 4: Verification & Hashing
After the dump is complete:
MOBILedit will automatically generate MD5/SHA1 hashes of the image.
Verify the hash matches when reloading the image for post-analysis.
This confirms the image has not been altered since acquisition, supporting forensic integrity.
Outcome:
At this stage, you have a full decrypted physical image (if unencrypted) or an encrypted image ready for brute-force analysis. You have successfully bypassed the OS and retrieved low-level NAND access without triggering a factory reset.
In the next section, we’ll focus on brute-forcing the encrypted image to extract the PIN or unlock credentials for full logical parsing.
Secure Bypass & Physical Acquisition Procedure
Once a physical image has been acquired from the ZTE Optus X Vista, the next step is to determine whether the image is encrypted. In nearly all cases involving screen locks, Unisoc/Spreadtrum-based Android devices will store user data within encrypted containers that require a PIN or pattern to decrypt.
MOBILedit Forensic Ultra is equipped with a dedicated brute-force module designed to identify and break these locks by analysing the encrypted image directly.
Step 1: Load the Physical Image
Launch MOBILedit Forensic Ultra and navigate to the Device Image Analyser module.
Import the physical image file acquired during the imaging process.
MOBILedit will scan the image for encryption flags and lockscreen artefacts.
Once identified, it will prompt you to initiate a brute-force attack.
Step 2: Configure Brute-Force Parameters
Select the correct lock type: typically Numeric PIN, but options also include pattern locks and alphanumeric passwords.
Define the length range to reduce processing time (e.g., 4–6 digits).
Enable GPU acceleration (if available) to significantly speed up the cracking process.
Optionally load a custom dictionary of common PINs or user-specific guesses.
MOBILedit uses parallelised, device-optimised brute-force techniques, tailored for SC9863A encryption structures.
Step 3: Begin the Brute-Force Attack
Click "Start Brute Force."
The software will display estimated time-to-crack and progress updates.
In the case of a 4-digit PIN, results often appear within 5–30 minutes; longer for 6+ digits.
You can pause and resume the attack at any time, and MOBILedit logs all attempts for documentation.
Step 4: PIN Recovery and Image Decryption
Once the correct PIN is discovered, it will be presented on-screen.
The decrypted image is then mounted automatically.
MOBILedit displays full access to the previously protected data structure.
Step 5: Explore Decrypted Image
Navigate through internal Android file paths: /data, /media, /system, and /misc
Analyse SQLite databases such as mmssms.db, contacts2.db, and WhatsApp/msgstore.db
Export chat logs, notes, browser history, downloaded files, and deleted data
You now have full logical access to the user partition, ready for structured forensic analysis.
✅ Summary
Successfully recovering data from locked ZTE devices like the Optus X Vista (Z66210) requires a blend of hardware awareness, chipset-level access, and advanced forensic tooling. Using MOBILedit Forensic Ultra, forensic professionals can:
Bypass the lockscreen non-destructively via diagnostic preload modes
Acquire a full physical image of the internal storage
Brute-force PIN codes directly from encrypted NAND images
Decrypt and access user data without triggering a factory reset
Whether recovering sensitive personal files, legal evidence, or irreplaceable digital records, this process ensures data can be extracted from ZTE and other Spreadtrum/Unisoc devices securely and effectively, even when all standard access methods have failed.
This guide demonstrates a repeatable, legally sound workflow that data recovery specialists can apply to a wide range of low-end Android phones built on the same hardware foundation.
Great article 👏